This month’s Patch Tuesday replace from Microsoft offers with 84 flaws and a zero-day affecting Microsoft Change that in the meanwhile stays unresolved. The Home windows updates deal with Microsoft safety and networking parts with a difficult-to-test replace to COM and OLE db. And Microsoft browsers get 18 updates—nothing important or pressing.

That leaves the main target this month on Microsoft Change and deploying mitigation efforts, moderately than server updates, for the following week. Extra details about the dangers of deploying these Patch Tuesday updates can be found on this infographic.

Microsoft continues to enhance each its vulnerability reporting and notifications with a brand new RSS feed, and Adobe has adopted swimsuit with improved reporting and launch documentation. As a delicate reminder, help for Home windows 10 21H1 ends in December.

Key testing situations

Given the massive variety of adjustments included this month, I’ve damaged down the testing situations into high-risk and standard-risk teams:

Excessive Danger: For October, Microsoft has not recorded any high-risk performance adjustments. This implies it has not made main adjustments to core APIs or to the performance to any of the core parts or functions included within the Home windows desktop and server ecosystems.

Extra typically, given the broad nature of this replace (Workplace and Home windows), we advise testing the next Home windows options and parts:

  • A GDI replace (GDIPLUS.DLL) requires testing of EMF, each 16- and 32-bit palette recordsdata (opening, printing, and creating).
  • Microsoft’s Desktop Utility Supervisor has been up to date and would require each provisioning and un-provisioning functions (each set up and uninstall testing is required).
  • The Home windows CLFS system has been up to date to require a brief take a look at of making, studying, updating, and deleting log recordsdata.

Along with these adjustments and testing necessities, I’ve included a few of the tougher testing situations:

  • OLE DB: The venerable Microsoft OLE DB has been up to date and requires all functions with a dependency on SQL Server 2012 or ADO.NET must be absolutely examined earlier than deployment. This Microsoft COM part (OLE DB) separates knowledge from software logic by a set of connections that entry knowledge supply, session(s), SQL instructions, and row-set knowledge.
  • Roaming credentials, cryptography keys, and certificates: To search out out extra about Credential Roaming, take a look at Microsoft’s Jim Tierney’s posting and this nice introduction to Credential Roaming.
  • Encrypted VPN Connections: Microsoft up to date the IKEv2 and L2TP/IPsec parts this month. Testing with distant connections ought to last more than eight hours. In case you are having hassle with this replace, Microsoft has revealed a L2TP/IPSec VPN Troubleshooting information.

Until in any other case specified, we should always now assume every Patch Tuesday replace would require testing core printing capabilities, together with:

  • printing from instantly linked printers;
  • massive print jobs from servers (particularly if they’re additionally area controllers);
  • distant printing (utilizing RDP and VPN).

Recognized points

Every month, Microsoft features a checklist of recognized points that relate to the working system and platforms included on this replace cycle.

  • Gadgets with Home windows installations created from customized offline media or a customized ISO picture might need Microsoft Edge Legacy eliminated by this replace, however not mechanically changed by the brand new Microsoft Edge. Resolving this situation would require a full/new set up of Microsoft Edge.
  • Microsoft SharePoint: This replace would possibly have an effect on some SharePoint 2010 workflow situations. It additionally generates “6ksbk” occasion tags in SharePoint Unified Logging System (ULS) logs.

One reported situation with the newest Microsoft Servicing Stack Replace (SSU) KB5018410 is that Group Coverage preferences might fail. Microsoft is engaged on an answer; within the meantime, the corporate posted the next mitigations:

  1. Uncheck the “Run in logged-on person’s safety context (person coverage possibility).” Word: this won’t mitigate the difficulty for gadgets utilizing a wildcard (*).
  2. Throughout the affected Group Coverage, change “Motion” from “Exchange” to “Replace.”
  3. If a wildcard (*) is used within the location or vacation spot, deleting the trailing “” (backslash, with out quotes) from the vacation spot would possibly enable the copy to achieve success.

Main revisions

To this point, Microsoft has not revealed any main revisions to its safety advisories. 

Mitigations and workarounds

There are two mitigations and 4 work-arounds for this October Patch Tuesday, together with:

  • CVE-2022-41803: Visible Studio Code Elevation. Microsoft revealed a fast work-around for this safety vulnerability that claims: “Create a folder C:ProgramDatajupyterkernels and configure it to be writable solely by the present person.”
  • CVE-2022-22041: Home windows Print Spooler Elevation. Microsoft’s revealed work-around recommendation for managing this vulnerability is to cease the printer spooler service on the goal machine utilizing the next PowerShell instructions, “Cease-Service -Title Spooler -Drive, and Set-Service -Title Spooler -StartupType Disabled.” This may cease the native print spooler on the machine and any printing providers utilized by that system.

Microsoft has additionally famous that for the next reported community vulnerabilities, these techniques are usually not affected if IPv6 is disabled and will be mitigated with the next PowerShell command: “Get-Service Ikeext:”

  • CVE-2022-37976: Home windows TCP/IP Driver Denial of Service Vulnerability;
  • CVE-2022-34721: Home windows Web Key Change (IKE) Protocol Extensions;
  • CVE-2022-3471, CVE-2022-33645 and CVE-2022-34718: Home windows TCP/IP Distant Code Execution Vulnerability.

Every month, we break down the replace cycle into product households (as outlined by Microsoft) with the next fundamental groupings:

  • Browsers (Microsoft IE and Edge);
  • Microsoft Home windows (each desktop and server);
  • Microsoft Workplace;
  • Microsoft Change;
  • Microsoft Improvement platforms ( ASP.NET Core, .NET Core and Chakra Core);
  • Adobe (retired???, perhaps subsequent 12 months).

Browsers

Microsoft launched 18 updates to Edge (Chromium). Solely CVE-2022-41035 particularly applies to the browser, whereas the remainder are Chromium associated. You’ll find this month’s launch be aware right here. These are low profile, non-critical patches to Microsoft’s newest browser; they are often added to your commonplace launch schedule.

Home windows

Microsoft delivers patches for 10 important and 57 vital vulnerabilities that cowl the next characteristic teams within the Home windows platform:

  • Home windows Networking (DNS, TLS, distant entry and the TCP/IP stack);
  • Cryptography (IKE extensions and Kerberos);
  • Printing (once more);
  • Microsoft COM and OLE DB;
  • Distant Desktop (Connection Supervisor and APIs).

One COM+ object-related vulnerability (CVE-2022-41033) has been reported as exploited within the wild. This makes issues robust for patch and replace deployment groups. Testing COM objects is mostly troublesome as a result of enterprise logic required and contained throughout the software. Additionally, figuring out which functions rely upon this characteristic will not be easy. That is particularly the case for in-house developed or line-of-business functions resulting from enterprise criticality. We advocate assessing, isolating, and testing core enterprise apps which have COM and OLE dB dependencies earlier than a basic deployment of the October replace. Add this Home windows replace to your “Patch Now” schedule.

On the lighter aspect of issues, Microsoft has launched one other Home windows 11 replace video.

Microsoft Workplace

This month we get two important updates (CVE-2022-41038 and CVE-2022-38048) and 4 updates rated as vital to the Microsoft Workplace platform. Until you’re managing a number of SharePoint servers, it is a comparatively low-profile replace, with no Preview Pane-based assault vectors and no stories of exploits within the wild. In the event you or your workforce skilled points with Microsoft Outlook crashing (sorry, “closing”) final month, Microsoft has gives the next recommendation:

  1. Signal out of Workplace;
  2. Flip off Assist Diagnostics;
  3. Set the next registry key: [HKEY_CURRENT_USERSoftwareMicrosoftOffice16.0OutlookOptionsGeneral] “DisableSupportDiagnostics”=dword:00000001;
  4. Restart your system.

Given these adjustments and low-profile updates, we advise that you simply add these Workplace patches to your commonplace launch schedule.

Microsoft Change Server

We must always have began with the Microsoft Change updates this month. The important remote-pcode execution vulnerabilities (CVE-2022-41082 and CVE-2022-41040) in Change have been reported as exploited within the wild and have not been resolved with this safety replace. There are patches obtainable, and they’re official from Microsoft. Nonetheless, these two updates to Microsoft Change Server don’t absolutely repair the vulnerabilities.

The Microsoft Change Group weblog makes this level explicitly in the midst of a launch be aware:

“The October 2022 SUs don’t include fixes for the zero-day vulnerabilities reported publicly on September 29, 2022 (CVE-2022-41040 and CVE-2022-41082). Please see this weblog put up to use mitigations for these vulnerabilities. We are going to launch updates for CVE-2022-41040 and CVE-2022-41082 when they’re prepared.”

Microsoft has revealed mitigation recommendation for these severe Change safety points, protecting:

  • CVE-2022-41040: Change Emergency Mitigation Service
  • CVE-2022-41082: Disable Distant PowerShell for Change

We advocate implementing each the URL and PowerShell mitigations for all of your Change servers. Watch this house, as we are going to see an replace from Microsoft within the upcoming week. 

Microsoft improvement platforms

Microsoft has launched 4 updates (all rated vital) for Visible Studio and .NET. Although all 4 vulnerabilities (CVE-2022-41032, CVE-2022-41032, CVE-2022-41034 and CVE-2022-41083) have commonplace entries within the Microsoft Safety Replace Information (MSUG), the Visible Studio workforce has additionally revealed these 17.3 Launch notes. (And, identical to Home windows 11, we even get a video.) All 4 of those updates are low-risk, low-profile updates to the event platform. Add these to your commonplace developer launch schedule.

Adobe (actually simply Reader)

Adobe Reader has been up to date (APSB22-46) to resolve six reminiscence associated vulnerabilities. With this launch, Adobe has additionally up to date launch documentation to incorporate Recognized Points and deliberate Launch Notes. These notes cowl each Home windows and MacOS and each variations of Reader (DC and Steady). All six reported vulnerabilities have the bottom Adobe ranking, 3, which Adobe helpfully gives the next patch recommendation for: “Adobe recommends directors set up the replace at their discretion.”